CVE-2026-103358

7.5High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.5High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on confidentiality
Weakness: CWE-94

Impact

Remote, unauthenticated attackers can execute arbitrary code to read sensitive application data over the network. No credentials or user interaction are required to exploit the flaw.

Root cause

Improper input sanitization allows untrusted input to be evaluated directly as executable code.

Affected systems

VillaTheme Email Template Customizer for WooCommerce (email-template-customizer-for-woo) through 1.3.4

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Fix & remediation

Upgrade the plugin to a version later than 1.3.4 once released. If an update is unavailable, deactivate the 'email-template-customizer-for-woo' plugin immediately.

shell

$ wp plugin deactivate email-template-customizer-for-woo

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Code Injection.This issue affects Email Template Customizer for WooCommerce: from n/a through 1.3.4.

References

https://patchstack.com/database/wordpress/plugin/email-template-customizer-for-woo/vulnerability/wordpress-email-template-customizer-for-woocommerce-plugin-1-3-4-content-injection-vulnerability?_s_id=cve

Source: nvd.nist.gov/vuln/detail/CVE-2026-103358